FreeRDP contains multiple buffer overflow vulnerabilities, including heap-buffer-overflow and global-buffer-overflow issues, identified as CVE-2026-22855, CVE-2026-22858, and CVE-2026-22859. These vulnerabilities affect the xfreerdp client component that connects to various RDP servers. Red Hat Product Security has released an update for Red Hat Enterprise Linux 9 and related CodeReady Linux Builder products to address these vulnerabilities. The advisory classifies the security impact as Important. No CVSS base score is provided in the advisory, but the issues are related to memory corruption weaknesses (CWE-125 and CWE-787). The update is available in freerdp version 2.11.7-1.el9_7.2 and later for affected Red Hat products.

Successful exploitation of these heap and global buffer overflow vulnerabilities could lead to memory corruption in the FreeRDP client. This may result in application crashes or potentially allow an attacker to execute arbitrary code or cause denial of service. The advisory rates the impact as Important, indicating a significant security risk if unpatched. There are no known exploits in the wild at the time of the advisory.

Red Hat has released an official security update that fixes these vulnerabilities in FreeRDP for Red Hat Enterprise Linux 9 and related products. Users should apply the update to freerdp version 2.11.7-1.el9_7.2 or later as provided by Red Hat. Detailed update instructions are available in the Red Hat advisory and article linked in the vendor advisory. No additional mitigation steps are indicated or required beyond applying the official patch.